
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
Core library for HZL - task tracking for coding agents and multi-agent workflows.
This package provides the business logic for programmatic use. For the CLI, install hzl-cli instead.
npm install hzl-core
import {
createConnection,
runMigrations,
EventStore,
ProjectionEngine,
TaskService,
ProjectService,
} from 'hzl-core';
// Initialize database
const db = createConnection('/path/to/data.db');
runMigrations(db);
// Set up event sourcing
const eventStore = new EventStore(db);
const projectionEngine = new ProjectionEngine(db, eventStore);
// Create services
const taskService = new TaskService(db, eventStore, projectionEngine);
const projectService = new ProjectService(db, eventStore, projectionEngine);
// Create a project and task
projectService.createProject({ name: 'my-project' });
const task = taskService.createTask({
title: 'Implement feature',
project: 'my-project',
});
// Claim and complete
taskService.claimTask(task.id, { owner: 'agent-1' });
taskService.completeTask(task.id);
Event Sourcing: All state changes are recorded as immutable events. The EventStore handles persistence, and projections derive current state.
Atomic Claiming: claimTask() and claimNext() use database transactions to prevent race conditions when multiple agents claim work concurrently.
Projections: Current state is rebuilt from events. The ProjectionEngine coordinates projectors that maintain specific views (tasks, dependencies, tags, etc.).
createConnection, runMigrations, withWriteTransactionEventStore, EventType, TaskStatusProjectionEngine, individual projectorsTaskService, ProjectService, SearchService, ValidationService, BackupServiceMIT
FAQs
Core library for HZL - External task ledger for coding agents and OpenClaw.
We found that hzl-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.